github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 09:36:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

Things are finally quieting down:

Browse Source 
- iwlwifi:
    - FW reset handshake removal for older devices
    - NIC access fix in fast resume
    - avoid too large command for some BIOSes
    - fix TX power constraints in AP mode
  - cfg80211:
    - fix netlink parse overflow
    - fix potential 6 GHz scan memory leak
    - enforce HE/EHT consistency to avoid mac80211 crash
  - mac80211: guard radiotap antenna parsing
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEpeA8sTs3M8SN2hR410qiO8sPaAAFAmogEAgACgkQ10qiO8sP
 aAD+jg//d9zDSJ7bBbDoNDgM2iTVlmaDR2Zri4Gjre16vNUwYYn0rvR1Z4auYQxT
 SwwEP3yNRECsF56vh6RlX5a7rqVQFKl2X3RCaBZ1vrzHus+xVf1HuBt2dq2FGSIX
 pxL8H/h34az3f+7FWHW5fgn6UjAZ47d18KzNp0yFlXYqSyimCrcDv9prneNCCac1
 9AdeLvIGyax9cW9zFI7wAj26bibFrEWxgYnM8ZaNJeYYoJfoFAXi7DkqGryjIBI/
 F1ENWTeaYNKa+8vdgpuknI40uVAQdKb/W5pP+fcj2AnO0hxUxItGbGrAuteAgq9b
 BneVgLB/tbrejXz2W8n926FougVCnlXJoQ6W08M5J7ZppCNilpgkl2JH54hjeGi4
 3UV3zusoeNqXM4yf0IOdfhSS5Rg8G7NSrDbAZClbsDOtLiFa1ic4keBodVS8umT4
 Yspb4dZ2Akg30LUvLKJ40zFkKG6b825ZwKw3SgKnH+1abm8Kvco3VmFqjnVc7QSc
 bOQCEUJovHgLR5AQF+UknGKbzNmWhdu6fWFJD805z0Z0VYtZT7O8MlnvRAB63i8B
 iGnDZM9eq9BgIq4xPeTnDy2E2j20GoNMaR1F2JII2HI3njhYrL3mNbvGa2EoZqTT
 6M1u5zXX6ydeNV0aP1lYF+ILikYFMTeMlQSBn5ejYELEm/RWvKg=
 =nKth
 -----END PGP SIGNATURE-----

Merge tag 'wireless-2026-06-03' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless

Johannes Berg says:

====================
Things are finally quieting down:
 - iwlwifi:
   - FW reset handshake removal for older devices
   - NIC access fix in fast resume
   - avoid too large command for some BIOSes
   - fix TX power constraints in AP mode
 - cfg80211:
   - fix netlink parse overflow
   - fix potential 6 GHz scan memory leak
   - enforce HE/EHT consistency to avoid mac80211 crash
 - mac80211: guard radiotap antenna parsing

* tag 'wireless-2026-06-03' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless:
  wifi: cfg80211: enforce HE/EHT cap/oper consistency
  wifi: fix leak if split 6 GHz scanning fails
  wifi: mac80211: limit injected antenna index in ieee80211_parse_tx_radiotap
  wifi: nl80211: reject oversized EMA RNR lists
  wifi: iwlwifi: pcie: simplify the resume flow if fast resume is not used
  wifi: iwlwifi: mvm: avoid oversized UATS command copy
  wifi: iwlwifi: mld: send tx power constraints before link activation
  wifi: iwlwifi: mvm: don't support the reset handshake for old firmwares
====================

Link: https://patch.msgid.link/20260603113208.171874-3-johannes@sipsolutions.net
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski 2026-06-03 19:07:34 -07:00
commit ac05609982
9 changed files with 88 additions and 37 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/net/wireless/intel/iwlwifi/mld/ap.c
View File

@ -9,7 +9,6 @@
#include "ap.h"
#include "hcmd.h"
#include "tx.h"
#include "power.h"
#include "key.h"
#include "phy.h"
#include "iwl-utils.h"
@ -273,9 +272,6 @@ int iwl_mld_start_ap_ibss(struct ieee80211_hw *hw,
struct ieee80211_chanctx_conf *ctx;
int ret;
if (vif->type == NL80211_IFTYPE_AP)
iwl_mld_send_ap_tx_power_constraint_cmd(mld, vif, link);
ret = iwl_mld_update_beacon_template(mld, vif, link);
if (ret)
return ret;

7
drivers/net/wireless/intel/iwlwifi/mld/mac80211.c
View File

@ -1150,6 +1150,13 @@ int iwl_mld_assign_vif_chanctx(struct ieee80211_hw *hw,
if (iwl_mld_can_activate_link(mld, vif, link)) {
iwl_mld_tlc_update_phy(mld, vif, link);
/* FW requires AP_TX_POWER_CONSTRAINTS_CMD before link
* activation for AP and after link activation for STA,
* for an unknown reason.
*/
if (vif->type == NL80211_IFTYPE_AP)
iwl_mld_send_ap_tx_power_constraint_cmd(mld, vif, link);
ret = iwl_mld_activate_link(mld, link);
if (ret)
goto err;

2
drivers/net/wireless/intel/iwlwifi/mld/power.c
View File

@ -366,7 +366,7 @@ iwl_mld_send_ap_tx_power_constraint_cmd(struct iwl_mld *mld,
lockdep_assert_wiphy(mld->wiphy);
if (!mld_link->active)
if (!mld_link->active && vif->type != NL80211_IFTYPE_AP)
return;
if (link->chanreq.oper.chan->band != NL80211_BAND_6GHZ)

28
drivers/net/wireless/intel/iwlwifi/mvm/fw.c
View File

@ -1,6 +1,6 @@
// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
/*
* Copyright (C) 2012-2014, 2018-2025 Intel Corporation
* Copyright (C) 2012-2014, 2018-2026 Intel Corporation
* Copyright (C) 2013-2015 Intel Mobile Communications GmbH
* Copyright (C) 2016-2017 Intel Deutschland GmbH
*/
@ -459,9 +459,14 @@ static void iwl_mvm_phy_filter_init(struct iwl_mvm *mvm,
static void iwl_mvm_uats_init(struct iwl_mvm *mvm)
{
struct iwl_mcc_allowed_ap_type_cmd_v1 *cmd __free(kfree) = NULL;
int cmd_id = WIDE_ID(REGULATORY_AND_NVM_GROUP,
MCC_ALLOWED_AP_TYPE_CMD);
struct iwl_mcc_allowed_ap_type_cmd_v1 cmd = {};
struct iwl_host_cmd hcmd = {
.id = cmd_id,
.len[0] = sizeof(*cmd),
.dataflags[0] = IWL_HCMD_DFL_NOCOPY,
};
u8 cmd_ver;
int ret;
@ -485,14 +490,25 @@ static void iwl_mvm_uats_init(struct iwl_mvm *mvm)
if (!mvm->fwrt.ap_type_cmd_valid)
return;
BUILD_BUG_ON(sizeof(mvm->fwrt.ap_type_cmd.mcc_to_ap_type_map) !=
sizeof(cmd.mcc_to_ap_type_map));
/* Since we free the command immediately after iwl_mvm_send_cmd, we
* must send this command in SYNC mode.
*/
lockdep_assert_held(&mvm->mutex);
memcpy(cmd.mcc_to_ap_type_map,
cmd = kzalloc_obj(*cmd);
if (!cmd)
return;
BUILD_BUG_ON(sizeof(mvm->fwrt.ap_type_cmd.mcc_to_ap_type_map) !=
sizeof(cmd->mcc_to_ap_type_map));
memcpy(cmd->mcc_to_ap_type_map,
mvm->fwrt.ap_type_cmd.mcc_to_ap_type_map,
sizeof(mvm->fwrt.ap_type_cmd.mcc_to_ap_type_map));
ret = iwl_mvm_send_cmd_pdu(mvm, cmd_id, 0, sizeof(cmd), &cmd);
hcmd.data[0] = cmd;
ret = iwl_mvm_send_cmd(mvm, &hcmd);
if (ret < 0)
IWL_ERR(mvm, "failed to send MCC_ALLOWED_AP_TYPE_CMD (%d)\n",
ret);

6
drivers/net/wireless/intel/iwlwifi/mvm/ops.c
View File

@ -1416,6 +1416,12 @@ iwl_op_mode_mvm_start(struct iwl_trans *trans, const struct iwl_rf_cfg *cfg,
fw_has_capa(&mvm->fw->ucode_capa,
IWL_UCODE_TLV_CAPA_FW_RESET_HANDSHAKE);
/* Those firmware versions claim to support the fw_reset_handshake
* but they are buggy.
*/
if (IWL_UCODE_MAJOR(mvm->fw->ucode_ver) <= 77)
trans->conf.fw_reset_handshake = false;
trans->conf.queue_alloc_cmd_ver =
iwl_fw_lookup_cmd_ver(mvm->fw,
WIDE_ID(DATA_PATH_GROUP,

56
drivers/net/wireless/intel/iwlwifi/pcie/drv.c
View File

@ -1225,33 +1225,41 @@ static int _iwl_pci_resume(struct device *device, bool restore)
if (!trans->op_mode)
return 0;
/*
* Scratch value was altered, this means the device was powered off, we
* need to reset it completely.
* Note: MAC (bits 0:7) will be cleared upon suspend even with wowlan,
* but not bits [15:8]. So if we have bits set in lower word, assume
* the device is alive.
* Alternatively, if the scratch value is 0xFFFFFFFF, then we no longer
* have access to the device and consider it powered off.
* For older devices, just try silently to grab the NIC.
*/
if (trans->mac_cfg->device_family >= IWL_DEVICE_FAMILY_BZ) {
u32 scratch = iwl_read32(trans, CSR_FUNC_SCRATCH);
if (!(scratch & CSR_FUNC_SCRATCH_POWER_OFF_MASK) ||
scratch == ~0U)
device_was_powered_off = true;
} else {
if (test_bit(STATUS_DEVICE_ENABLED, &trans->status)) {
/*
* bh are re-enabled by iwl_trans_pcie_release_nic_access,
* so re-enable them if _iwl_trans_pcie_grab_nic_access fails.
* Scratch value was altered, this means the device was powered
* off, we need to reset it completely.
* Note: MAC (bits 0:7) will be cleared upon suspend even with
* wowlan, but not bits [15:8]. So if we have bits set in lower
* word, assume the device is alive.
* Alternatively, if the scratch value is 0xFFFFFFFF, then we
* no longer have access to the device and consider it powered
* off.
* For older devices, just try silently to grab the NIC.
*/
local_bh_disable();
if (_iwl_trans_pcie_grab_nic_access(trans, true)) {
iwl_trans_pcie_release_nic_access(trans);
if (trans->mac_cfg->device_family >= IWL_DEVICE_FAMILY_BZ) {
u32 scratch = iwl_read32(trans, CSR_FUNC_SCRATCH);
if (!(scratch & CSR_FUNC_SCRATCH_POWER_OFF_MASK) ||
scratch == ~0U) {
IWL_DEBUG_WOWLAN(trans,
"Scratch 0x%08x indicates device was powered off\n",
scratch);
device_was_powered_off = true;
}
} else {
device_was_powered_off = true;
local_bh_enable();
/*
* bh are re-enabled by iwl_trans_pcie_release_nic_access,
* so re-enable them if _iwl_trans_pcie_grab_nic_access
* fails.
*/
local_bh_disable();
if (_iwl_trans_pcie_grab_nic_access(trans, true)) {
iwl_trans_pcie_release_nic_access(trans);
} else {
device_was_powered_off = true;
local_bh_enable();
}
}
}

4
net/mac80211/tx.c
View File

@ -2181,7 +2181,9 @@ bool ieee80211_parse_tx_radiotap(struct sk_buff *skb,
case IEEE80211_RADIOTAP_ANTENNA:
/* this can appear multiple times, keep a bitmap */
info->control.antennas |= BIT(*iterator.this_arg);
/* control.antennas is only a 2-bit bitmap */
if (*iterator.this_arg < 2)
info->control.antennas |= BIT(*iterator.this_arg);
break;
case IEEE80211_RADIOTAP_DATA_RETRIES:

9
net/wireless/nl80211.c
View File

@ -6366,6 +6366,9 @@ nl80211_parse_rnr_elems(struct wiphy *wiphy, struct nlattr *attrs,
if (ret)
return ERR_PTR(ret);
if (num_elems >= 255)
return ERR_PTR(-EINVAL);
num_elems++;
}
@ -6711,6 +6714,12 @@ static int nl80211_calculate_ap_params(struct cfg80211_ap_settings *params)
return -EINVAL;
}
if (!!params->he_cap != !!params->he_oper)
return -EINVAL;
if (!!params->eht_cap != !!params->eht_oper)
return -EINVAL;
return 0;
}

9
net/wireless/scan.c
View File

@ -1071,6 +1071,7 @@ int cfg80211_scan(struct cfg80211_registered_device *rdev)
struct cfg80211_scan_request_int *request;
struct cfg80211_scan_request_int *rdev_req = rdev->scan_req;
u32 n_channels = 0, idx, i;
int err;
if (!(rdev->wiphy.flags & WIPHY_FLAG_SPLIT_SCAN_6GHZ)) {
rdev_req->req.first_part = true;
@ -1100,8 +1101,14 @@ int cfg80211_scan(struct cfg80211_registered_device *rdev)
rdev_req->req.scan_6ghz = false;
rdev_req->req.first_part = true;
err = rdev_scan(rdev, request);
if (err) {
kfree(request);
return err;
}
rdev->int_scan_req = request;
return rdev_scan(rdev, request);
return 0;
}
void ___cfg80211_scan_done(struct cfg80211_registered_device *rdev,